Secrets Management: HashiCorp Vault vs Infisical vs Doppler

Why Secrets Management Matters

If your secrets are in .env files committed to Git, environment variables on a shared server, or a shared 1Password vault, you have a secrets management problem. Secrets (API keys, database passwords, TLS certificates) need to be:

• Centralized: One source of truth, not scattered across servers and repos
• Encrypted: At rest and in transit
• Audited: Every access logged with who, what, when
• Rotatable: Change a secret without redeploying services
• Access-controlled: Each service gets only the secrets it needs

HashiCorp Vault: The Enterprise Standard

Vault is the most feature-rich secrets management tool. It supports secret engines (KV, databases, PKI, SSH, cloud IAM), dynamic secrets, and encryption-as-a-service.

# Start Vault in dev mode (for learning)
vault server -dev

# Store a secret
vault kv put secret/myapp/database \
  username=dbadmin \
  password=supersecret \
  host=postgres.internal

# Read a secret
vault kv get secret/myapp/database

# Dynamic database credentials (auto-rotated)
vault write database/config/postgres \
  plugin_name=postgresql-database-plugin \
  connection_url="postgresql://{{username}}:{{password}}@postgres:5432/app" \
  allowed_roles="readonly,readwrite" \
  username="vault" \
  password="vault-password"

vault write database/roles/readonly \
  db_name=postgres \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# Get dynamic credentials (new user created, auto-expires)
vault read database/creds/readonly
# username: v-token-readonly-abc123
# password: A1B2C3D4E5
# ttl: 1h

Vault with Kubernetes:

# Vault Agent injector - automatically injects secrets into pods
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/agent-inject-secret-db: "secret/data/myapp/database"
        vault.hashicorp.com/agent-inject-template-db: |
          {{- with secret "secret/data/myapp/database" -}}
          DB_HOST={{ .Data.data.host }}
          DB_USER={{ .Data.data.username }}
          DB_PASS={{ .Data.data.password }}
          {{- end }}
        vault.hashicorp.com/role: "myapp"
    spec:
      containers:
        - name: app
          image: my-app:latest
          command: ["sh", "-c", "source /vault/secrets/db && node server.js"]

Infisical: The Developer-Friendly Alternative

Infisical is an open-source secrets management platform designed for developer experience. It has a clean UI, native integrations, and is much simpler to operate than Vault.

At TechSaaS, we run Infisical at secrets.techsaas.cloud for our own secrets management.

# Install Infisical CLI
curl -1sLf https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh | sudo bash
sudo apt install infisical

# Login
infisical login

# Pull secrets into your environment
infisical run -- docker compose up -d

# Pull secrets for a specific environment
infisical export --env=production --format=dotenv > .env

# Inject secrets into any command
infisical run --env=production -- npm start

Infisical with Docker Compose:

# docker-compose.yml
services:
  my-app:
    image: my-app:latest
    environment:
      INFISICAL_TOKEN: "st.xxxx.yyyy"
    command: >
      sh -c "infisical run --env=production -- node server.js"

Infisical secret referencing — reference secrets across projects:

# In Infisical dashboard
DB_HOST = postgres.internal
DB_PORT = 5432
DB_NAME = myapp
DB_URL = postgresql://admin:password@{DB_HOST}:{DB_PORT}/{DB_NAME}

• You need dynamic secrets (auto-rotating database credentials)
• You need PKI / certificate management
• You need encryption-as-a-service
• You have a dedicated security or platform team
• You run Kubernetes and want the mature Agent Injector

Choose Infisical when:

• Developer experience is the priority
• You want to self-host but keep it simple
• Your team is small-to-medium
• You need quick setup (under 30 minutes)
• You want an open-source MIT-licensed solution

Choose Doppler when:

• You do not want to manage any infrastructure
• Your team is entirely cloud-native
• You want the easiest onboarding experience
• Budget allows per-user pricing

Secret Rotation Strategy

Regardless of tool, implement a rotation strategy:

Critical secrets (DB passwords, API keys): Rotate every 30 days
Service tokens: Rotate every 90 days
TLS certificates: Auto-renew at 30 days before expiry
Personal access tokens: Rotate every 90 days, revoke on offboarding

At TechSaaS, we use Infisical for our self-hosted secrets management. It runs as a single Docker container with PostgreSQL and Redis (which we already have), and the UI makes it easy for our team to manage secrets across environments. For clients with advanced needs like dynamic database credentials or PKI, we deploy Vault with a managed HA configuration.